About this plugin
com), the Webfiable service that reviews the security and configuration of websites.
Without the plugin, Webfiable only sees what your site shows from the outside. With the plugin, and with your consent, it can read the full list of installed plugins and themes with their versions, and the exact WordPress and PHP versions. It uses that data to analyse your site, and the plugin connects your site to the panel where Webfiable shows its analyses.
How it works
- You install and activate the plugin.
- In Settings → Webfiable you enter your email, give your consent and leave the data connection on.
- The plugin checks that the connection answers and registers your site with Webfiable.
- You sign in to your panel at https://siteaudit.webfiable.com/acceso with that email: you receive a single-use sign-in link, with no password.
If the plugin was already set up before an update, your site registers again once after the update, in the background, without you having to do anything.
The plugin sends no email and no reports by email. The only messages you receive are the sign-in links you ask for on the panel’s sign-in page.
What data it shares
Only if you give your consent and the data connection is on:
- the site address and an identifier the plugin creates when it is activated;
- the versions of WordPress, of PHP and of the plugin itself;
- the installed plugins and themes: name, identifier, version and short description;
- the email you enter in the settings and the date you gave your consent.
It does not read your content, your users, passwords or any other credential.
How it protects that data
- The list is served encrypted at your site’s /webfiable address: AES-256-CBC for the data and RSA-2048 for the key, with a new initialisation vector for every response. Anyone can request that address, but only Webfiable holds the private key that reads the answer. The encryption keeps the content confidential; it does not sign it, and it does not limit who can ask.
- That address answers only after you give your consent and while the data connection is on, and it serves at most 25 requests per minute to the same IP address.
- If you withdraw your consent, the address stops serving the list at once and the data connection is switched off.
- The registration call itself (site identifier, site address and email) is sent as JSON over HTTPS.
External service: Webfiable
com):
- Registration. When you save the settings with your consent given, and once after each plugin update if you had already given it, the plugin sends the site identifier, the site address and the email from the settings over HTTPS to https://webfiable.com/wp-json/webfiable/v1/activations.
- Reading. Afterwards, Webfiable requests your site’s /webfiable address and reads, encrypted, the data listed above.
com/aviso-legal/
Language
The settings screen is written in Spanish and includes an English translation, which WordPress uses when your dashboard language is not Spanish.